Privacy Policy
Last updated: 2026-10-26
Scope
This policy explains how Camonster (camonster.online) handles data for document scanning, OCR, conversion, PDF, QR code, design and media tools. Data handling varies by feature: some run entirely in your browser, while others require server processing.
Content you provide
We process content needed for the feature you choose, such as images, documents, text for recognition, QR code content, signatures and settings. Scanning, OCR, some document conversions and QR code structure generation send necessary data to our server. Local media playback, recording and local editing do not automatically upload an entire video when you select it. Camera, microphone and screen capture require browser permission.
Temporary processing and deletion
Ordinary uploads are held in memory or a temporary workspace only for the current task. We do not create a document library, publish uploads or use them to train models. Scan inputs are removed after processing; results are removed after delivery, cancellation or expiry. Unclaimed scan results normally expire about two minutes after completion. Other synchronous conversions release temporary data when the request ends. Cross-device signing and signing invitations temporarily hold necessary signatures or documents until cancellation, retrieval or expiry; links last at most fifteen minutes. Undownloaded browser results may be lost when you close the page.
Browser storage and sessions
Some design tools use IndexedDB or localStorage to keep projects, preferences and recovery data on your device. You can remove them using available delete controls or your browser’s site-data settings; closing a tab does not necessarily clear local storage. Other tools use temporary session identifiers to separate tasks. You control downloaded files and copies you deliberately save or share.
Third-party sign-in and Google data
Designated tools, including document scanning and QR codes, require Google sign-in. With your authorization, we read and store your stable Google account identifier, verified email and display name to identify your account, manage sign-in, apply tool permissions and track usage quotas. Basic profile authorization may include a profile image, which we do not store. We do not request Gmail, Google Drive or contacts access. Google access tokens and ID tokens are held only temporarily for sign-in verification; refresh tokens are not retained. Google user data is never sold or used for advertising or model training; where applicable, we comply with the Google API Services User Data Policy, including Limited Use requirements. You can revoke access in your Google Account’s third-party connections settings.
Account records and retention
Account details are retained until you delete the account or request deletion. Sign-in cookies last up to seven days and guest-identifier cookies up to one year; unfinished sign-in requests expire after about ten minutes. To enforce quotas and permissions we store tool identifiers, usage counts and timestamps, not the associated documents, images or QR code content. Usage records are retained for up to thirty-one days and administrative change logs for up to ninety days, then cleaned up. Members can delete their account in the account menu or request deletion using the email below. Deletion removes account details, sessions, individual permissions and usage records; necessary security, administrative or legal records may remain only for the required period. Administrators use a separate account and sign-in cookie (up to eight hours). Administrator passwords are stored only as scrypt hashes, not plaintext; administrator sign-in does not replace a Google member session.
Technical data and service providers
To deliver the site, protect it and diagnose errors, our servers and infrastructure providers may process IP addresses, browser information, request paths, timestamps and error logs. We use Cloudflare for traffic delivery and security, so requests may pass through servers in different countries. Providers process data as needed to deliver their services; data may also be disclosed where legally required or processed to prevent abuse. We do not sell personal data. If you email us, the message is handled through email providers and retained only as needed to respond, resolve the request or meet legal obligations.
Sharing and security
We use HTTPS, session isolation and temporary-data cleanup to reduce risk, but no system can guarantee absolute security. Share signing or pairing links only with intended recipients; anyone holding a valid link may access what it permits. Others can scan a QR code, so do not encode passwords or personal information you do not want to disclose. Third-party websites and content you deliberately share are subject to their respective data practices.
Your choices and policy updates
You can stop using the service, revoke browser permissions, clear local site data and contact us to exercise data rights available under applicable law. We can delete only data still held by us, not copies downloaded or shared by you or others. Updates will be dated on this page; new data uses will be disclosed before processing, with consent obtained where required.
Contact us
For questions about this policy, the terms or your personal data, or to request access, correction or deletion, contact Camonster. We may need to verify your identity; please do not email passwords or complete sensitive documents.